Architectural Registers API

Apr 22, 2026 00:00:00

Architectural Registers API

Access via ql.arch.regs. See source: qiling/arch/register.py.

Registers can be specified by name (e.g. 'eax') or Unicorn constant (e.g. UC_X86_REG_EAX).

Reading Registers

Two equivalent methods:

1# By name
2value = ql.arch.regs.read('eax')
3
4# By Unicorn constant
5value = ql.arch.regs.read(UC_X86_REG_EAX)
6
7# As property (preferred for readability)
8value = ql.arch.regs.eax

Writing Registers

1# By name
2ql.arch.regs.write('ecx', 0xdeadface)
3
4# By Unicorn constant
5ql.arch.regs.write(UC_X86_REG_ECX, 0xdeadface)
6
7# As property (enables read-modify-write)
8ql.arch.regs.ecx = 0xdeadface
9ql.arch.regs.eflags |= (0b1 << 6)  # set zero flag

Generic Cross-Architecture Aliases

These aliases work across all architectures:

1# Program counter
2pc = ql.arch.regs.arch_pc   # reads eip (x86), pc (ARM), rip (x86-64), etc.
3ql.arch.regs.arch_pc = 0x00400000
4
5# Stack pointer
6sp = ql.arch.regs.arch_sp   # reads esp (x86), sp (ARM), rsp (x86-64), etc.
7ql.arch.regs.arch_sp = 0x7ffff000

Architecture-Specific Resources

Intel MSR (Model Specific Registers)

Access via ql.arch.msr:

1IA32_BIOS_SIGN_ID = 0x8b
2bios_sig = ql.arch.msr.read(IA32_BIOS_SIGN_ID)
3
4IA32_APIC_BASE_MSR = 0x1b
5apic_base = 0xfee00000
6# Set APIC base with BSP flag (bit 8) and global enable (bit 11)
7ql.arch.msr.write(IA32_APIC_BASE_MSR, apic_base | (0b1 << 8) | (0b1 << 11))

ARM / AArch64 Coprocessors

AArch32 via ql.arch.cpr, AArch64 via ql.arch.cpr64:

1from qiling.arch.arm_const import CPACR
2
3# Read CPACR, then enable full access to cp10 and cp11 (VFP/NEON)
4cpacr = ql.arch.cpr.read(*CPACR)
5ql.arch.cpr.write(*CPACR, cpacr | (0b11 << 20) | (0b11 << 22))